Automatically Inferring the Evolution of Malicious Activity on the Internet
Automatically Inferring the Evolution of Malicious Activity on the Internet
复制标题
自动推断互联网上恶意活动的演变
DOI：
--
复制
发表时间：
2013
期刊：
影响因子：
--
通讯作者：
Oliver Spatscheck
中科院分区：
文献类型：
--
作者：
Shobha Venkataraman;David Brumley;S. Sen;Oliver Spatscheck
基于互联网的服务通常与一系列恶意活动（例如，垃圾邮件、扫描、僵尸网络），这些问题可能来自全球互联网基础设施的几乎任何部分，并可能随着时间的推移而纵向转移。在本文中，我们开发了第一个算法技术，以自动推断互联网区域的安全特性在网上的时尚。从概念上讲，我们的主要思想是在互联网上的恶意活动建模为一个决策树的IP地址空间，并确定恶意活动的动态推断的动态决策树。我们对邮件数据和僵尸网络数据的大型语料库的评估表明，我们的算法是快速的，可以跟上互联网规模的流量数据，并可以提取恶意活动源的变化大大优于（2.5倍）的方法基于使用预先确定的聚合水平，如基于BGP的网络感知集群。我们的案例研究表明，我们的算法能够将恶意活动的大量转移总结到少量的IP区域（多达两个数量级），从而有助于集中有限的运营商资源。使用我们的算法，我们发现，互联网的某些地区往往比其他地区更快的变化，如一组中小型托管服务提供商是特别感兴趣的邮件运营商。
Internet-based services routinely contend with a range of malicious activity (e.g., spam, scans, botnets) that can potentially arise from virtually any part of the global Internet infrastructure and that can shift longitudinally over time. In this paper, we develop the first algorithmic techniques to automatically infer regions of the Internet with shifting security characteristics in an online fashion. Conceptually, our key idea is to model the malicious activity on the Internet as a decision tree over the IP address space, and identify the dynamics of the malicious activity by inferring the dynamics of the decision tree. Our evaluations on large corpuses of mail data and botnet data indicate that our algorithms are fast, can keep up with Internet-scale traffic data, and can extract changes in sources of malicious activity substantially better (a factor of 2.5) than approaches based on using predetermined levels of aggregation such as BGP-based network-aware clusters. Our case studies demonstrate our algorithm’s ability to summarize large shifts in malicious activity to a small number of IP regions (by as much as two orders of magnitude), and thus help focus limited operator resources. Using our algorithms, we find that some regions of the Internet are prone to much faster changes than others, such as a set of small and medium-sized hosting providers that are of particular interest to mail operators.